FBI identifies 628 Binance laundering addresses as withdrawals restart in phases

The FBI turns attribution into a transaction-blocking request

The FBI’s October 31 alert attributes the Binance theft to North Korean activity it calls TraderTraitor and identifies 628 cryptocurrency addresses: 608 Ethereum, 19 Bitcoin and one Solana. The bureau describes those addresses as holding, or having held, stolen assets. That distinction matters: the list provides transaction-screening indicators, not a statement that all the money remains at those addresses. [1]

The FBI, Secret Service and IRS-CI urge relevant providers to block transactions involving the identified addresses or assets derived from them. The request reaches exchanges, node operators, decentralized finance services and instant-swap providers. Its practical reach is disputed, however. The Record reports that some decentralized platforms challenged their ability to stop transactions. The government request therefore should not be read as evidence that every service can freeze funds. [1][11]

Independent tracing supports the response, with limits

The official attribution is clear, but the FBI alert does not publish a detailed evidentiary case. TRM Labs separately reports a high-confidence North Korean attribution based on on-chain and off-chain intelligence. TRM’s and Elliptic’s original transaction analyses add independent evidence about the transfers and handling of proceeds. Articles repeating the FBI announcement are not separate corroboration of responsibility, and company statements about recovery do not independently validate the attribution. [1][6][7]